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Executive  Summary 


Introduction.  Information  technology  systems  have  typically  used  two  digits  to  represent 
the  year,  such  as  “98”  representing  1998,  to  conserve  electronic  data  storage  and  reduce 
operating  costs.  With  the  two-digit  format,  however,  the  year  2000  is  indistinguishable 
from  1900.  As  a  result  of  this  ambiguity,  computers  and  associated  systems  and 
application  programs  that  use  dates  to  <^culate,  compare,  wd  sort  could  generate 
incorrect  results  when  working  with  years  after  1999.  This  is  one  of  a  series  of  reports 
being  issued  by  the  Inspector  General,  DoD,  in  accordance  with  an  informal  partnership 
with  the  Chief  Ifdbrmation  Officer,  DoD,  to  monitor  DoD  efforts  to  address  the  year  2000 
computing  challenge. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  initiatives  of 
the  Ballistic  Missile  Defense  Organization  and  its  field  activities  to  address  the  year  2000 
computer  problems  were  effective  and  whether  they  complied  with  the  DoD  Year  2000 
Management  Plan.  We  also  were  to  evaluate  the  management  control  program  as  it 
applied  to  the  audit  objectives,  but  because  it  was  urgent  to  report  the  audit  results  to 
senior  management,  we  did  not  formally  evaluate  related  management  controls. 

Audit  Results.  The  Medium  Extended  Air  Defense  System  program  and  the  National 
Missile  Defense  programs  initiated  actions  to  ensure  that  future  contracts  include 
year  2000  compliance  clauses  (Finding  A).  However,  the  April  1998  quarterly  year  2000 
report  from  the  Holistic  Missile  Defense  Organization  did  not  accurately  report  progress 
made  in  solving  year  2000  problems.  In  March  1998,  BMDO  did  take  positive  action  to 
address  the  year  2000  problem  by  establishing  a  year  2(X)0  project  management  office,  but 
additional  work  is  still  needed.  Also,  officials  fi'om  the  Ballistic  Missile  Defense 
Organization  incorrectly  approved  the  Theater  High  Altitude  Area  Defense  system  and  all 
four  of  the  National  Missile  Defense  program  elements  to  proceed  beyond  the 
assessment  phase  (Finding  B). 

As  a  result,  DoD  received  and  forwarded  to  0MB  overstated  progress  reports  on  the 
year  2000  effort  for  the  Theater  High  Altitude  Area  Defense  and  the  National  Missile 
Defense  programs.  In  addition,  the  risk  for  a  timely  solution  to  the  year  2000  problem  for 
these  programs  was  increased.  The  audit  results  are  detailed  in  Part  I. 

Summary  of  Recommendations.  We  recommend  that  the  Chief  Information  Officer, 
Ballistic  Misrile  Defense  Organization,  review  the  year  2000  effort  for  the  Theater  High 
Altitude  Area  Defense  program  and  determine  if  it  meets  the  exit  criteria  for  the 


assessment  phase;  determine  the  correct  reporting  phase  for  the  next  DoD  year  2000 
quarterly  report;  and  implement  procedures  to  certify  that  the  ejdt  criteria  are  met  for  each 
mission-critical  program  before  granting  approval  for  it  to  proceed  to  the  nert  year  2000 
phase.  In  addition,  we  recommend  that  the  CWef  Information  Officer,  Ballistic  Mi^ile 
Defense  Organization,  require  the  National  Missile  Defense  program  office  to  obtain  a 
detailed  assessment  plan  from  each  program  element. 

Management  Comments.  The  Director,  Ballistic  Missile  Defense  Organization, 
concurr^  with  the  findings  and  all  the  recommendations  except  requiring  a  separate 
assessment  plan  for  each  program  element.  However,  the  actions  taken  by  management 
meet  the  intent  of  that  recommendation.  See  Part  I  for  a  summary  of  management 
comments  and  our  responses  and  Part  III  for  the  complete  text  of  management  comments. 
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Parti -Audit  Results 


Audit  Background 

Year  2000.  The  year  2000  (Y2K)  problem  is  rooted  in  the  way  dates  are  recorded 
and  computed  in  information  technology  systems.  For  the  past  several  decades, 
computer  systems  have  typically  used  two  digits  to  represent  the  year,  such 
as  “98”  representing  1998,  to  conserve  on  electronic  data  storage  and  reduce 
operating  costs.  With  the  two-di^t  format,  however,  the  Y2K  is  indistinguishable 
from  1900.  Because  of  its  potential  operational  impact  on  Government  computers, 
the  General  Accounting  Ofnce  identified  Y2K  as  a  high-risk  program.  DoD  also 
identified  Y2K  as  an  uncorrected  material  management  control  weakness  in  its 
Annual  Statement  of  Assurance  for  FY  1997. 

Ballistic  Missile  Defense  Organization.  The  mission  of  the  Ballistic  Missile 
Defense  Organization  (BMDO)  is  to  develop  and  field  effective  military  defenses 
against  ballistic  missile  attacks.  To  accomplish  this,  BMDO  manages,  directs,  and 
executes  a  program  that  focuses  on  the  development  and  deployment  of  the 
Theater  Air  and  Missile  Defense  to  meet  the  missile  threat  to  deployed  U.S.  and 
allied  forces,  and  the  National  Missile  Defense  (NMD)  to  protect  the  United 
States. 

To  facilitate  the  Y2K  reporting  requirements  of  DoD,  BMDO  identified  two 
categories  of  systems:  mission  support,  which  is  administrative;  and  mission 
oriented,  which  is  needed  to  acquire  and  deploy  a  weapon  system.  BMDO  did  not 
identify  any  mission-support  systems  as  mission  critical.  In  the  mission-oriented 
category,  BMDO  identined  two  weapon  systems  as  mission  critical.  They  include 
the  Theater  Air  and  Missile  Defense  system  and  the  NMD  system.  The  Theater 
Air  and  Missile  Defense  system  consists  of  the  Theater  High  Altitude  Area 
Defense  (THAAD),  the  AEGIS  Baseline  6  Phase  3,  the  Standard  Missile  II  Block 
IV/IVA,  the  Standard  Missile  III  Lightweight  Exo-Atmospheric  Projectile,  the 
Medium  Extended  Air  Defense  System,  and  the  Patriot  Advanced  Capability  3 
acquisition  programs.  The  NMD  system  is  one  acquisition  program  consisting  of 
four  BMDO-sponsored  elements  including  the  Ground  Bas^  Radar;  the  Battle 
Management  Command,  Control,  and  Commuracations;  the  Ground  Based 
Interceptor;  and  the  Upgrade  Early  Warning  Radar.  BMDO  established  an  NMD 
joint  program  office  in  April  1997  to  manage  and  integrate  the  program  elements 
into  a  cost-effective  and  operationally  sound  system  designed  to  protect  the  SO 
States  from  a  ballistic  missile  attack.  Each  mission-criticd  system  is  described  in 
Appendix  B. 

Because  the  Theater  Air  and  Missile  Defense  and  NMD  systems  rely  heavily  on 
computer  systems  to  carry  out  their  operations,  the  Y2K  issues  can  affect  every 
aspect  of  the  BNff)0  mission.  As  a  result  of  the  ambiguity,  computers  and 
associated  systems  and  application  programs  that  use  ^tes  to  calculate,  compare, 
or  sort  could  generate  incorrect  results  when  working  with  years  after  1999. 

DoD  Y2K  Guidance.  The  DoD  Y2K  Management  Plan  (DoD  Management 
Plan),  Version  1.0,  April  1997,  details  the  five-phase  Y2K  management  process, 
the  key  responsibilities  of  DoD  Components,  the  quarterly  reporting  requirements, 
and  the  timeline  for  completing  each  Y2K  phase.  The  DoD  Management  Plan  also 
states  the  criteria  for  DoD  Components  to  determine  the  appropriate  Y2K  phase 
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for  each  system  noted  in  the  quarterly  report.  Each  phase  listed  below  represents  a 
major  Y2K  program  activity  or  segment.  Target  completion  dates  range  from 
December  1996  through  November  1999. 

•  Phase  I  -  Awareness.  Organization  and  planning  take  place.  Target 
completion  date;  December  1996. 

•  Phase  II  -  Assessment.  Scope  ofY2K  impact  is  identified  and 
systems'level  analysis  takes  place.  Target  completion  date;  June  1997. 

•  Phase  III  -  Renovation.  Required  system  fixes  are  accomplished. 

Target  completion  date:  December  1998. 

•  Phase  IV  -  Validation.  Systems  are  confirmed  as  Y2K  compliant 
through  assorted  testing-and-compliance  processes.  Target  completion 
date;  January  1999. 

•  Phase  V  -  Implementation.  Systems  are  fully  operational  after  being 
certified  as  Y2K  compliant.  Target  completion  date;  November  1999. 

Each  system  must  meet  defined  exit  criteria  before  proceeding  into  the  next  phase. 


Audit  Objectives 


The  overall  audit  objective  was  to  determine  whether  the  initiatives  of  BMDO  and 
its  field  activities  to  address  the  Y2K  computer  problem  were  effective. 
Specifically,  we  determined  whether  BMDO  and  its  field  activities  have  complied 
with  the  DoD  Management  Plan.  We  were  also  to  evaluate  the  management 
control  program  as  it  applied  to  the  audit  objectives  but,  because  senior  DoD 
management  urgently  needed  the  audit  results  and  DoD  recognizes  the  Y2K  issue 
as  a  material  management  control  weakness  area  in  the  FY  1997  Annual  Statement 
of  Assurance,  we  did  not  formally  evaluate  related  management  controls.  See 
Appendix  A  for  a  discussion  of  the  scope  and  methodology  and  prior  audit 
coverage. 
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Finding  A.  Ballistic  Missile  Defense 
Organization  Year  2000  Contract 
Compliance 

Officials  from  the  BMDO-sponsored  Medium  Extended  Air  Defense 
System  program  office  and  the  NMD  program  office  initiated  positive 
actions  to  ensure  that  future  contracts  for  the  programs  will  include 
Y2K>compliance  clauses.  Program  officials  from  the  Medium  Extended 
Air  Defense  System  program  changed  the  information  to  be  provided  to 
current  contractors  and  BMDO  officials  planned  to  revise  the  lead  system 
integrator  contract  after  we  identified  the  omission  of  Y2K  compliance 
language  in  the  solicitations  sent  to  prospective  bidders.  Accordingly, 
contracts  for  the  design  and  development  of  the  Medium  Extended  Air 
Defense  System  and  the  integration  of  the  NMD  program  should  be  Y2K 
compliant. 


DoD  Policy 

DoD  Y2K  Guidance.  The  DoD  Management  Plan,  Version  1.0,  April  1997, 
states  that  DoD  will  purchase  only  Y2K>compliant  products  and  that  DoD 
contracts  will  use  Y2K-compliance  language  if  the  information  technology 
involves  or  performs  date-and-time  processing  after  December  31,  1999. 


Contracting  Actions 

Of  the  sbc  acquisition  programs  included  in  the  Theater  Air  and  ^ssile  Defense 
system,  only  the  Medium  Extended  Air  Defense  System  did  not  include  a 
requirement  that  the  software  be  Y2K  compliant  in  the  current  contract.  In 
addition,  the  request  for  proposal  for  the  NMD  system  integration  did  not  require 
the  software  to  be  Y2K  compliant. 

Medium  Extended  Air  Defense  System.  During  the  current  program  definition 
and  validation  phase,  which  is  scheduled  to  end  in  March  1999,  the  Medium 
Extended  Air  Defense  System  contract  requires  that  both  contractors  deliver  a 
proposal  for  the  design  and  development  phase  of  the  program.  The  contract 
requires  that  the  international  contracting  agency  for  the  Medium  Extmded  Air 
Defense  System  provide  the  two  current  contractors  with  final  instmetions  on 
preparing  their  proposals  and  the  program  structure.  The  contracting  agency  must 
^so  submit  information  on  how  it  will  evaluate  the  contractors’  proposals. 

The  February  1998  instruction  (draft  Version  4.0)  did  not  require  that  the  system 
software  be  Y2K  compliant.  In  addition,  the  Bh^O  cominents  on  the  draft 
instruction  did  not  include  the  DoD  requirement  that  agencies  purchase  only  Y2K- 
compliant  products  and  did  not  address  the  Y2K  issue. 
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Finding  A.  Ballistic  Missile  Defense  Organization  Year  2000  Contract  Compliance 


In  March  1998,  we  informed  program  officials  of  the  Y2K  deficiency  in  the 
instructions.  The  officials  stated  that  they  would  incorporate  the  requirements  for 
the  proposals  to  be  Y2K  compliant  in  the  instruction  after  the  next  meeting  of  the 
steering  committee  that  manages  the  Medium  Extended  Air  Defense  System 
international  program.  The  steering  committee  must  approve  the  inclusion  of  the 
Y2K-compliance  information  in  the  instmctions  it  sends  to  the  contractors.  In 
May  1998,  program  office  officials  informed  us  that  the  steering  committee  agreed 
to  include  a  clause  in  the  information  sent  to  the  offerors  that  required  all  software 
to  satisfy  the  participating  nations’  Y2K  initiatives.  The  program  office  will  also 
incorporate  the  Y2K  requirements  into  the  International  Technical  Requirements 
Document,  which  defined  the  technical  parameters  for  developing  the  system.  In 
this  way,  the  proposals  submitted  by  the  two  contractors  will  meet  the  Y2K 
technical  parameters  for  the  system. 

NMD.  The  Y2K-compliance  clause  was  not  in  the  existing  contracts  for  all  four 
elements  of  the  NMD  program  as  of  March  1998.  Program  officials  stated  that  the 
lead  system  integrator  contract  should  include  Y2K-compIiance  language.  The 
integration  contract  will  incorporate  all  system  elements  including  interceptors, 
sensors,  and  command  and  control  functions  into  a  deployable,  cohesive  NMD 
system.  The  contract  requires  design  and  development  and  test  and  evaluation 
services  to  ensure  the  success  of  the  integrated  system  tests  that  are  planned  for 
the  fourth  quarter  FY  1999  and  the  deployment  readiness  review  that  is  planned 
for  the  third  quarter  FY  2000. 

The  NMD  Request  for  Proposal,  August  1997,  amended  September  1997,  for  the 
integration  effort  did  not  contain  Y2K«compliance  language.  BMDO  officials 
received  the  best  and  final  offers  fi'om  two  contractors  in  March  1998  and  awarded 
the  integration  contract  without  a  Y2K-compIiance  clause  for  the  NMD  system  in 
May  1998. 

After  we  identified  the  deficiency,  BMDO  officials  initiated  actions  to  include  a 
Y2K-compliance  clause  in  the  inte^ation  and  development  contract.  NMD 
officials  prepared  a  draft  modification  to  the  lead  system  integrator  contract  and 
they  plan  to  add  a  Y2K>compliance  clause  using  specific  text  from  the  Federal 
Acquisition  Regulation.  The  NMD  program  will  then  be  Y2K  compliant. 


Conclusion 

We  commend  the  Medium  Extended  Air  Defense  System  and  NMD  program 
officials  for  taking  prompt  action  to  include  a  Y2K-compliance  clause  in  their 
contracts  for  new  system  development.  This  will  help  DoD  in  its  effort  to  ensure 
that  no  system  is  adversely  affected  by  Y2K  problems.  Because  management  took 
corrective  action  during  the  audit,  no  recommendations  are  necessary. 
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Finding  B.  Ballistic  Missile  Defense 
Organization  Year  2000  Reporting 

The  BMDO  Y2K  quarterly  report,  dated  April  1998,  did  not  accurately 
report  BMDO’s  progress  in  solving  the  Y2K  problem  for  the  THAAD 
program.  In  addition,  BMDO  later  incorrectly  approved  the  THAAD  and 
the  NMD  programs  to  exit  the  assessment  phase.  This  occurred  because 
BMDO  officials  did  not  verify  whether  the  THAAD  and  the  NMD 
program  had  met  the  requirements  of  the  Y2K  assessment  phase.  As  a 
result,  DoD  reported  and  relied  on  inaccurate  information  and  the  risk  of 
Y2K  noncompliance  and  system  failure  increased. 


Y2K  Quarterly  Report 

DoD  Reporting  Requirements.  A  March  12, 1997,  memorandum  from  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and 
Intelligence)  requires  DoD  Components  to  submit  Y2K  quarterly  status  reports  to 
satisfy  requirements  of  DoD  and  the  Office  of  Management  and  Budget.  Quarterly 
reports  are  used  by  the  DoD  Chief  Information  Officer  to  oversee  and  monitor 
progress,  to  identify  and  prioritize  risks,  and  to  solve  Y2K  problems  as  quickly  as 
possible.  In  addition,  if  erroneous  information  goes  unrecognized,  computers  and 
weapon  systems  may  fail,  and  the  problem  will  perpetuate  through  interfaces  and 
other  automated  information  systems. 


Assessment  Phase  Requirements 

The  purpose  of  the  assessment  phase  is  to  gather  and  analyze  information  to 
determine  the  size  and  scope  of  the  Y2K  problem.  DoD  Components  must 
develop  a  Y2K  cost  estimate  to  repair  an  existing  system,  a  contingency  plan  to 
consider  the  consequences  of  noncompliance,  and  a  Y2K  assessment  plan.  The 
assessment  plan  should  include  the  size  and  scope  of  the  Y2K  problem;  necessary 
infrastructures;  software  inventories,  including  contractor  off-the-shelf  products; 
and  should  identify  system  interfaces. 

For  a  ^stem  to  advance  from  the  assessment  phase  to  the  renovation  phase,  the 
DoD  Management  Plan  requires  the  Service  or  DoD  Component  to  document  and 
complete  the  following  exit  criteria; 

•  an  assessment  plan, 

•  a  renovation  strategy, 

•  a  Y2K-resource  strategy  and  plan. 
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•  a  validation  strategy,  and 

•  a  risk-management  and  contingency  strategy. 


Progress  Reported 

Of  the  five  acquisition  programs  that  we  reviewed  in  the  Theater  Air  and  Missile 
Defense  system  and  the  four  program  elements  of  the  NMD  program,  BMDO 
incorrectly  reported  THAAD  and  NMD  program  progress  in  solving  the  Y2K 
problem. 

Y2K  Reporting  for  the  THAAD.  BMDO  incorrectly  reported  in  the  January 
1998  quarterly  report  that  the  THAAD  program  was  in  the  validation  phase.  This 
was  based  on  inaccurate  information  that  the  THAAD  program  office  had  included 
in  the  Defense  Integrated  Support  Tools  database,  which  was  the  official  inventory 
of  DoD  systems  and  contained  information  on  hardware,  the  Y2K  phase,  and 
interfaces. 

In  February  1998,  the  THAAD  program  office  submitted  a  technical  survey  to 
BMDO  that  disclosed  the  Y2K  impact  on  all  systems,  DoD  Components,  software, 
and  interfaces.  Based  on  its  review  of  the  survey  results,  BMDO  identified  that  the 
THAAD  program  office  had  not  met  the  exit  criteria  of  the  assessment  phase. 
Accordingly,  BhffiO  moved  the  program  back  to  the  assessment  phase. 

TBAAD  Y2K  Assessment.  Also  in  February  1998,  after  BMDO  placed  the 
THAAD  program  back  into  the  assessment  phase,  the  THAAD  program  office 
completed  a  second  Y2K  assessment  of  the  THAAD  software,  contractor  and 
Government  off-the-shelf  items,  and  system  interfaces,  resulting  in  BMDO 
approval  of  the  program  to  proceed  to  the  renovation  phase. 

Y2K  Reporting  for  the  NMD.  NMD  joint  program  officiids  incorrectly  indicated 
that  the  NMD  program  had  successfully  completed  the  requirements  of  the  Y2K 
assessment  phase  in  early  February  1998.  This  decirion  was  based  on  the 
completion  of  the  assessment  phase  exit  criteria  that  included  an  assessment  plan. 
As  a  result,  in  Februaiy  1998,  BMDO  approved  the  program  to  proceed  to  the 
validation  phase  because  the  program  was  new  development  and  the  joint  program 
office  did  not  consider  that  the  renovation  Y2K  phase  was  applicable. 


BMDO  Oversight 

BMDO  Realignment  Actions.  In  March  1998,  BMDO  established  a  Y2K  project 
office  to  realign  management.  The  office  established  procedures  to  monitor  and 
track  system  status  and  to  make  weekly  reports  to  BMDO  managment.  Th^  use 
metrics  to  capture  phase  status,  memorandum  of  agreements  activities,  exit 
criteria,  and  auditing  and  compliance  validation.  In  addition,  the  project 
management  office  reviews  documentation  before  moving  the  system  on  to  the 
next  phase.  Further,  the  project  management  office  instituted  a  compliance 


7 


Finding  B,  Ballistic  Missile  Defense  Organization  Year  2000  Reporting 


validation  program  that  requires  all  systems  to  pass  a  review  board  before  it  can  be 
certified  as  Y2K  compliant.  While  these  are  positive  steps  to  help  in  correcting  the 
Y2K  problem,  BN®0  must  do  more. 

Quaiteriy  Reporting  for  the  THAAD.  The  January  1998  Y2K  quarterly  report 
was  inaccurate  because  BMDO  relied  on  incorrect  information  reported  by  the 
THAAD  program  office  in  the  Defense  Integrated  Support  Tools  database  that 
BMDO  had  not  verified.  DoD  stopped  using  the  Defense  Integrated  Support 
Tools  database  to  collect  Y2K  information  in  March  1998,  and  will  implement  a 
new  database  by  the  summer  of  1998.  BMDO  also  incorrectly  reported  in  the 
April  1998  quarterly  report  that  the  THA^  program  was  in  the  renovation  phase 
because  BNflX)  did  not  verify  the  information  the  THAAD  program  office 
submitted. 

Renovation-Phase  Approval  for  the  THAAD.  BMDO’s  review  of  the  THAAD 
assessment-phase  progress  was  insufficient.  In  a  memorandum  dated  February  26, 
1998,  BMDO  stated  that  it  had  reviewed  THAAD  program  Y2K  documentation 
and  that  all  met  the  requirements  for  the  assessment,  renovation,  validation, 
resource,  and  contingency  strategies.  In  addition,  BMDO  stated  that  the  THAAD 
program  office  met  the  required  DoD  assessment-phase  eidt  criteria;  therefore,  it 
approved  the  THAAD  program  to  proceed  to  the  renovation  phase. 

The  THAAD  program  office  did  not  perform  an  adequate  assessment  of  the  Y2K 
issue.  For  example,  its  inventory  of  63  contractor  offithe-shelf  products  showed 
that  9  used  a  date  in  their  applications  but  that  their  Y2K  compliance  was 
unknown.  An  additional  14  products  showed  both  the  date  usage  and  the  Y2K 
compliance  as  unknown.  Furthermore,  the  assessment  showed  that  the  THAAD 
program  office  had  not  determined  whether  12  of  the  13  external  interfaces  were 
Y2K  compliant. 

As  a  result,  the  THAAD  program  office  was  unable  to  complete  several 
requirements  of  the  assessment  plan.  Specifically,  the  program  office  was  unable 
to  define  the  size  and  scope  of  the  problem,  document  the  necess^  infi-astructure, 
prepare  cost  estimates,  and  identify  systems  that  required  renovation.  Therefore, 
BMDO  should  not  have  wproved  the  program  to  proceed  to  the  renovation  phase. 
The  THAAD  program  office  did  have  strategies  for  renovation,  validation, 
resources,  and  contingencies;  however,  because  the  program  office  did  not 
perform  an  adequate  assessment  to  determine  the  size  and  scope  of  the  problem, 
which  is  an  essential  ingredient  and  the  foundation  for  developing  the  strategies, 
the  strategies  are  ineffective. 

NMD  Completion  of  Assessment-Phase  Exit  Criteria.  jSMDO  did  not  require 
an  assessment  plan  fi'om  the  NMD  program  elements  but,  instead,  relied  on  the 
NMD  joint  program  office  assessment  plan  to  meet  the  exit  criteria  requirements. 
Officials  from  the  NMD  joint  program  office  developed  an  assessment  plan,  “NMD 
Year  2000  Assessment  Phase  Plan  for  the  Remaining  Stages,”  ('^e  Plan),  undated, 
to  meet  the  exit  criteria  of  the  assessment  phase.  The  Plan  identified,  in  broad  and 
general  terms,  the  planned  progression  of  the  NMD  program  through  the  five-step 
Y2K  phases  and  identified  an  NMD  program  strategy  to  complete  the  phases.  The 
Plan  provided  start  and  release  dates  for  each  Y2K  phase  and  general  steps  for 
certifying  the  systems  as  Y2K  compliant.  Of  the  four  NMD  program  elements, 
only  the  Upgrade  Early  Warning  Radar  prepared  an  assessment  plan. 
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The  Plan  did  not  address  the  necessary  infrastructure  and  resources  required  to 
accomplish  the  testing  tasks  for  each  program  element.  The  Plan  also  did  not 
identify  the  size  and  scope  of  the  Y2K  problem,  inventories,  and  system  interfaces 
for  each  program  element.  The  program  office  did  have  strategies  for  renovation, 
validation,  resources,  and  contingencies  that  were  included  in  the  assessment  plan; 
however,  these  strategies  are  ineffective  because  they  do  not  address  each  element 
of  the  program. 

Officials  from  the  BMDO  NMD  joint  program  office  should  have  ensured  that 
each  NMD  element  prepared  a  comprehensive  plan  during  the  assessment  phase. 
A  comprehensive  Y2K  assessment  plan  minimizes  costs  and  shifting  of  resources, 
establishes  accurate  schedules  and  nulestones,  identifies  deficiencies,  and  lessens 
risks  as  a  system  progresses  through  the  phases. 


Conclusion 

If  BMDO  officials  had  adequately  reviewed  and  validated  the  information 
submitted  by  the  THAAD  program  office,  it  is  unlikely  that  BMDO  would  have 
reported  the  program  in  the  validation  phase  and  grwted  approval  to  advance  to 
the  renovation  phase.  BMDO  reported  and  DoD  relied  on  inaccurate  information 
for  the  THAAD  program. 

Without  an  accurate  and  detailed  Y2K  assessment  plan  for  the  NMD  program 
elements,  system  managers  may  underestimate  the  work  and  the  resources  required 
to  make  a  system  Y2K  compliant.  Performing  an  accurate  assessment  and 
developing  a  detailed  assessment  plan  allows  system  managers  to  develop  realistic 
milestones  and  increases  the  probability  of  meeting  them. 

As  a  result,  the  risk  to  solve  the  Y2K  problem  as  it  affected  the  THAAD  program 
and  NMD  elements  increased.  If  mission-critical  computers  supporting  the 
THAAD  or  the  NMD  systems  fail,  the  THAAD  or  the  NMD  systems  themselves 
may  also  fail.  And,  if  erroneous  information  goes  unrecognized,  it  will  perpetuate 
through  interfaces  and  other  automated  information  systems. 

Therefore,  it  is  vital  that  BMDO  ensure  that  the  requirements  of  each  phase  are 
met  before  granting  approval  to  proceed  to  the  next  phase.  BMDO  needs  to 
implement  procedures  to  certify  that  a  program  has  met  the  ewt  criteria  before  it  is 
approved  to  proceed  to  the  next  Y2K  phase.  BMDO  should  have  reviewed  the 
Y2K  effort  for  the  THAAD  and  NMD  programs  and  determined  the  correct  Y2K 
reporting  phases. 
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Recommendations,  Management  Comments,  and  Audit 
Response 

B.  We  recommend  that  the  Chief  Information  Officer,  Ballistic  Missile 
Defense  Organization: 

1.  Review  the  year  2000  effort  for  the  Theater  High  Altitude  Area 
Defense  Program  to  determine  whether  it  meets  the  exit  criteria  for  the 
assessment  phase, 

2.  Determine  the  appropriate  reporting  phase  for  the  Theater  High 
Altitude  Area  Defense  Program’s  next  quarterly  report, 

3.  Implement  procedures  to  certify  that  the  exit  criteria  are  met  for 
each  mission-critical  program  before  granting  approval  for  the  program  to 
proceed  to  the  next  phase,  and 

4.  Require  the  National  Missile  Defense  program  office  to  obtain  a 
detailed  assessment  plan  from  each  program  element  that  includes  the  size 
and  scope  of  the  Y2K  problem;  necessary  infrastructures;  inventories  of  all 
software,  including  contractor  off-the-shelf  products;  testing;  and 
identification  of  system  interfaces. 

Management  Comments.  The  Director,  Ballistic  Missile  Defense  Organization, 
concurred  with  all  recommendations  except  the  one  that  required  a  separate 
assessment  plan  for  each  program  element.  The  Director  stated  that  officials 
reviewed  the  exit  criteria  for  the  Theater  High  Altitude  Area  Defense  program  and 
determined  that  they  met  the  exit  criteria  for  the  assessment  phase  and  are  properly 
reported  in  the  Renovation  Phase.  In  addition,  officials  established  a  Year  2000 
Management  Control  Office  and  a  compliance  retdew  program  to  certify  that  all 
Ballistic  Missile  Defense  systems  are  diligent  in  the  Y2K  effort.  Th^also 
established  a  compliance  board  to  review  all  exit  criteria  before  phase  miration. 
Finally,  officials  stated  that  they  reviewed  all  National  Missile  Defense  exit  criteria 
and  have  enough  detailed  information  on  which  to  base  a  valid  assessment  of  the 
National  Missile  Defense  Y2K  situation. 

Audit  Response.  The  Ballistic  Missile  Defense  Organization  comments  are 
responsive  to  recommendations  B.I.,  B.2.,  and  B.3.  Although  officials 
nonconcurred  with  recommendation  B.4.,  the  actions  taken  are  responsive  to  the 
intent  of  that  recommendation. 
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Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD, 
to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a  listing  of 
audit  projects  addressing  this  issue,  see  the  Y2K  webpage  on  IGnet  at 
<http://www.ignet.gov>. 


Scope 

We  reviewed  the  Y2K  quarterly  report  for  the  first  quarter  ending  December  3 1, 
1997,  that  BMDO  submitted  to  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communication,  and  Intdligence).  We  evaluated  the  completeness  and 
reliability  of  the  report  in  accordance  with  reporting  requirements  of  the  Chief 
Information  Officer.  We  also  evaluated  its  usefulness  in  reporting  Y2K  progress 
to  the  Office  of  Management  and  Budget  and  to  Congress.  At  BMDO 
headquarters,  we  interviewed  personnel  responsible  for  issuing  reporting  guidance 
and  collecting  Y2K  information  fi'om  field  activities,  and  interviewed  Semce 
personnel  at  BMDO  field  activities  responsible  for  Y2K  quarterly  reporting 

We  reviewed  National  Misrile  Defense  program  mission-criticd  elements  including 
the  Battle  Management,  Comfnand,  Control,  and  Communication;  the  Upgrade 
Eariy  Warning  Radar;  the  X  Band  Radar;  and  the  Ground  Based  Interceptor.  We 
also  reviewed  five  of  the  six  programs  comprising  the  Theater  Air  tmd  Missile 
Defense  system.  The  programs  were  the  Patriot  Advanced  Capability  3,  the 
Theater  Hi^  Altitude  Area  Defense;  the  Medium  Extended  Air  Defense  System, 
the  Standard  Missile  n  Block  IV/IVA,  and  the  Standard  ^ssile  Block  III 
Lightweight  Exo-Atmospheric  Projectile.  We  did  not  review  the  AEGIS  Baseline 
6  Phase  3  program  because  the  Inspector  General,  Department  of  the  Navy,  had 
just  completed  an  inspection  of  the  Naval  Sea  Systems  Command  Y2K  program, 
which  includes  AEGIS,  to  assess  the  ability  of  the  Navy  to  ensure  that  mission- 
critical  systems  will  be  Y2K  compliant. 

DoD-wide  Corporate  Level  Government  Performance  and  Results  Act  Goals. 
In  response  to  the  Government  Performance  and  Results  Act,  the  Department  of 
Defense  has  established  6  DoD-wide  corporate  level  peiformance  objectives  and 
14  goals  for  meeting  these  objectives.  The  report  pertains  to  achievement  of  the 
following  objective  and  goal: 

•  Objective:  Prepare  now  for  an  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  war  fighting  capabilities.  (DoD-3) 
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DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  for  the  following  functional  area  objective  and  goal; 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  services  that  satisfy  customer  information  needs. 

•  Goal:  Upgrade  technology  base.  (ITM>2.3) 

General  Accounting  Office  High  Risk  Area.  The  General  Accounting  Office 
has  identified  several  high  risk  areas  in  the  DoD.  This  report  provides  coverage  of 
the  Information  Management  and  Technology  high  risk  area. 


Methodology 


We  performed  this  economy  and  efficiency  audit  from  January  through  April  1998, 
in  accordance  with  auditing  standards  issued  by  the  Comptroller  General  of  the 
United  States,  as  implemented  by  the  Inspector  General,  DoD. 

We  reviewed  material  dated  from  December  1997  through  April  1998.  We 
evaluated  BMDO  policies  and  procedures  for  identifying,  planning,  and 
implementing  corrections  to  systems  affected  by  the  Y2K  problem.  We  did  not 
use  computer-processed  data  or  statistical  sampling  procedures  for  this  audit. 


Prior  Audit  Coverage 


The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have  conducted 
multiple  reviews  related  to  Y2K  issues.  General  Accounting  Office  reports  can  be 
accessed  over  the  internet  at  HTTP://www.gao.gov.  Inspector  General,  DoD, 
reports  can  be  accessed  over  the  Internet  at  HTTP;//www.dodig. osd.mil. 


Organizations  and  Individuals  Visited  or  Contacted 

We  visited  or  contacted  individuals  and  organizations  within  DoD,  the  General 
Accounting  Office,  and  the  North  Atlantic  Treaty  Organization  Medium  ^ 
Defense  System  Management  Agency,  Huntsville,  Alabama.  Further  detuls  are 
available  on  request. 
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Management  Control  Program 

We  did  not  review  the  self-assessment  aspects  of  the  management  control  program 
as  it  relates  to  the  audit  objectives  because  the  Secretary  of  Defense  Letter  of 
Assurance  for  FY  1997  recognizes  Y2K  as  a  material  management  control 
weakness  area.  The  audit  findings  indicate  that  controls  have  not  been  fully 
effective.  The  problems  relate  to  the  application  of  controls  rather  than  their 
structure,  and  we  found  no  additional  material  management  control  weaknesses  in 
the  Y2K  conversion  program. 
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Systems  of  Theater  Air  and  Missile  Defense 

AEGIS  Baseline  6  Phase  3.  The  Navy  AEGIS  system  is  a  shipboard,  anti-air 
warfare,  area  defense  system  that  detects  and  tracks  short-  to  medium-range 
theater  ballistic  missiles  during  their  descent  phase.  The  Navy  Program  Office 
Executive,  Theater  Area  Defense,  is  the  executive  agent  responsible  for  developing 
the  program.  AEGIS  is  currently  in  Phase  II,  “Engineering  and  Manufacturing 
Development.” 

Medium  Extended  Air  Defense  System.  The  Medium  Emended  Air  Defense 
System  is  a  multi-national  North  Atlantic  Treaty  Orgamzation  effort  to  develop  a 
future  divisional  air  defense  system  to  replace  existing  missile  systems.  The 
program  will  include  a  missile,  sensors  and  battle  management,  commsmd,  control, 
computers,  and  intelligence  elements  to  satisfy  the  Int^ation^  Technical 
Requirements  Document.  The  program  is  an  Acquisition  Category  1  program 
currently  in  the  program  definition  and  validation  phase.  The  United  States, 
Germany,  and  Italy  signed  the  Memorandum  of  Agreement  on  May  28,  1996,  to 
implement  this  phase  with  a  60,  25,  and  15  percent  cost-share,  respectively.  The 
Medium  Extended  Air  Defense  System  Management  Agency  manages  the  program 
through  a  steering  committee  composed  of  members  from  the  three  countries  who 
provide  program  direction  and  oversi^t.  Two  contractors  are  working  in  the 
current  phase.  BMDO  ffinded  the  definition  and  validation  phase  of  the  program. 
The  Army  serves  as  liaison  between  the  Medium  Extended  Air  Defense  System 
Management  Agency  and  external  organizations  and  represents  U.S.  interests  in 
program  matters. 

Patriot  Advanced  Capability  3.  The  Army  Patriot  Advanced  Capability  3  is  an 
upgraded  ground  system  and  a  new  interceptor  for  the  Army  High-Medium  ^r 
Defense  Systm.  The  executive  agent  for  the  Patriot  Advanced  Capability  3  is  the 
Army  Program  Executive  Office,  Air  and  Nfissile  Defense.  The  program  is 
currently  in  Phase  II,  “Engineering  and  Manufacturing  Development.” 

Standard  Missile  n  Block  IV/IVA.  The  Navy  Standard  Missile  II  Block  IV/IVA 
is  an  interceptor  used  with  AEGIS  platforms  to  negate  short-  to  medium-range 
theater  ballistic  missiles.  The  Navy  Program  Office  Executive  for  Theater  Area 
Defense  is  the  executive  agent  for  this  pro^am.  The  Standard  Missile  11  Block 
IV/IVA  is  currently  in  Phase  II,  “Engineering,  Manufacturing,  and  Development.” 

Standard  Missile  m  Lightweight  Exo-Atmospheric  Projectile.  The  Navy 
Standard  Missile  III  Lightweight  Exo-Atmospheric  Projectile  is  a  sea-based  exo- 
atmospheric  interceptor  to  counter  medium-  to  long-range  theater  ballistic  missiles. 
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The  Navy  Program  Office  Executive  for  Theater  Area  Defense  is  the  executive 
agent  for  this  program.  The  program  is  currently  in  Phase  I,  “Program  Definition 
and  Risk  Reduction.” 

THAAD.  The  Army  THAAD  mission  is  to  defend  and  protect  critical  military 
assets  and  civilian  population  centers  against  theater  ballistic  missile  threats.  The 
THAAD  will  provide  land-based  area  defense  against  short-  and  long-range  theater 
ballistic  missiles.  The  THAAD  is  in  Phase  I,  “Program  Definition  and  Risk 
Reduction.” 


NMD  Program 

The  NMD  program  is  designed  to  be  a  cost-effective  and  operationally  sound 
system  to  protect  the  continental  Unit^  States  from  a  ballistic  missile  attack.  The 
NMD-BK&O-fiinded  portion  of  the  program  consists  of  multiple-service  elements 
that  include  the  Ground  Based  Interceptor;  the  Battle  Management  Command, 
Control,  and  Communications;  the  X  Band  Radar;  and  the  Upgraded  Early 
Warning  Radar.  On  April  9,  1996,  the  Under  Secretary  of  Defense  for  Acquisition 
and  Technology  designated  NMD  as  a  major  defense  acquisition  program.  The 
program  is  also  a  Deployment  Readiness  “3  plus  3”  program,  which  is  designed  to 
develop  and  test  for  3  years  and  deploy  for  the  following  3  years  if  the  threat 
materi^izes. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Ballistic  Missile  Defense  Organization 

Chief  Information  Officer,  Ballistic  Missile  Defense  Organization 
Director,  Defense  Lo^stics  Studies  Information  Exchange 
Under  Secrets^  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 

Deputy  Comptroller  (Program/Budget)  , 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
DoD  Year  2000  Project  Officer 
Assistant  Secretary  of  Defense  (Public  Affairs) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 

Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 

Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Lo^stics  Agency 
Director,  National  Security  Agency 

Inspector  General,  Nation^  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
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Non>Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Non-Defense  Federal  Organizations  and  Individuals 


Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional  conunittees 
and  subcommittees; 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Comnuttee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Conunittee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  lidbrmation,  and  Technology, 
Committee  on  Government  Reform  and  Over«ght 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
House  Committee  on  Nationsd  Security 

Chairman  and  Vice  Chairman  of  the  following  congressional  committee; 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 
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Ballistic  Missile  Defense  Organization 
Comments 


DCPARTMENT  OF  DEFENSE 
BALUSTIC  MISSIUE  DEFENSE  ORGANIZATION 
7100  DCrCNK  nMTAOON 
WASHINGTOM.DC  90901*7100 


June  19 •  1998 


NEHORANDUM  FOR  IHSPBCTOR  GENERAL,  DEPARINENT  OF  DEFENSE 

SUBJECT:  Dopartmont  of  Deftnoe  Inapoctor  General  (DoDIG)  Draft 
Audit  Report,  *Balliatic  Hiaeile  Defenee  Organisation 
Year  2000  Initiatives*,  DoDIG  Report  No>  BAB>3004 

The  Ballistic  Missile  Defense  Organisation  <BMD0)  conducted 
a  review  of  the  OoDXG  Draft  Audit  Report,  *Ballistlc  Missile 
Defense  Organisation  Year  2000  Initiatives*,  DoDIG  Report 
No*  eAB0004. 

The  BMDO  concurs  with  Finding  B,  one  through  three 
recossModations  with  the  following  consients.  The  first  and  second 
recoHnendations  have  been  addressed.  The  BMDO  Y2X  Program 
Managesttnt  Office  (PMO)  in  conjunction  with  the  BMDO/AQ  Y2R  OPR, 
CDR  Haggerty,  revie%#ed  the  previously  submitted  THAAD  program 
office  exit  criteria  and  discovered  several  discrepancies  with 
the  January  OSD  Quarterly  Report  submission.  The  reporting 
phase  was  erroneously  reported  by  PEO-AM)  to  BMDO  and  was 
subeeguently  corrected  to  place  TKAAD  in  the  Aascssinent  Phase  on 
February  27,  1998.  Following  a  submissicm  of  revised  reports  by 
PBO-JIMD,  CDR  Haggerty  upgraded  THAAD 'a  status  to  Renovation,  as 
reported  to  Nr.  Anthony  Valletta,  Acting  ASD  (C3I)  on 
March  2,  1998.  The  exit  criteria  for  THAAD  to  migrate  from  the 
Assessment  Phase  was  subsequently  re* reviewed  by  CDR  Haggerty  and 
the  BMDO  Y2K  PMO,  and  cont^nad  sufficiant  information  to  migrate 
THAAD  to  the  Renovation  Phasa.  The  THAAD  eyatem  haa  many  sub* 
components  and  BMDO  will  continue  to  reassess  them.  However, 

BMDO  has  mst  the  exit  criteria  and  can  document  that  THAAD  is 
currently  in  the  Renovation  Phase. 

The  third  recommendation  has  been  addressed  by  the  BMDO 
leaderehip  in  the  establiahment  of  the  BMDO  Y2K  PMO  on 
March  2,  1998.  The  BMDO  Y2X  PMO  personnel  in  conjunction  with 
the  system  OPRs  review  all  exit  criteria  eubmitted  and  the  PMO 
grants  the  migration  approval  for  each  phase.  This  is  further 
validated  by  the  establishment  of  the  BMDO  Compliance  Review 
Board  (CRB)  where  all  systems  must  be  reviewed  and  certified  as 
having  performed  due  diligence  in  being  Y2K  compliant.  The  CRB 
certifies  that  the  system  is  Y2E  conpllant  and  recommends  to  the 
CIO  that  they  be  approved  for  Y2X  certification.  Once  a^^roved, 
the  CIO  receives  weakly  BMDO  Y2K  statue  updates  on  the 
certification  process. 
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Final  Repoi 
Reference 


The  BMDO  doe*  not  concur  with  Finding  B«  fourth 
reconnendation  requiring  the  HMD  Joint  Program  Office  to  obtain  a 
detailed  aaaeaamcnt  plan  from  each  eyatem  program  office.  The 
BMDO  Year  2000  management  has  had  major  ahifte  within  the  laat 
mix  months  with  the  establiahnent  of  the  BMDO  Y2IC  Program 
Management  Office  (PMO) .  The  PMO  in  conjunction  with  the  NMD  JPO 
have  made  significant  efforts  to  meet  the  intent  of  the  OSD  Year 
2000  program.  The  attached  NMD  memorandum  and  National  Missile 
Defense  Joint  Program  Office  Year  2000  Compliance  Initiative 
{submitted  to  the  DoDIQ  Team  in  February  1998)  are  examples  of 
the  due  diligence  in  complying  with  the  DoD  and  BMDO  Year  2000 
Management  Plana.  The  National  Missile  Defense  Joint  Program 
Office  Year  2000  Cospliance  Initiative  is  the  documented 
Assessment  Phase  exit  criteria  for  the  NMD  system.  Based  upon 
the  attached  documents  submitted  by  the  NMD  JPO,  the  BMDO  feels 
that  efforts  to  revisit  the  Assessment  Phase  would  not  be  in  the 
best  interests  of  DoD  or  the  NHD  JPO. 

My  point  of  contact  for  this  issue  is  Major  Emily  Andrew, 
BMDO/TOH,  at (703) 804 -3881. 


TER  L.  LYLES 
ieutenant  General,  USAF 
Director 


Attachment : 

As  stated 


‘Omitted  because  of  length.  Copies  will  be  provided  upon  request. 
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